# Creating a User Account

__*zz-BGL*__
__*zz-Jeff*__

+ User account name is case-sensitive
+ When connecting, TiDB checks not only the `username`, but also what `host` users are connecting from
+ For example:
  + **Example 1:** User `test` from `127.0.0.1`
  + **Example 2:** User `TEST` from `192.168.10.X` subnet
  + **Example 3:** User `Test` from anywhere
  + **Example 4:** To remove a user account

```
~!@// Example 1@!~
CREATE USER 'test'@'127.0.0.1' IDENTIFIED BY '1234';

~!@// Example 2@!~
CREATE USER 'TEST'@'192.168.10.%';

~!@// Example 3@!~
CREATE USER 'Test'; or CREATE USER 'Test'@'%';

~!@// Example 4@!~
DROP USER 'TEST'@'192.168.10.%';
```

-------------------------------------------------------------
There are two ways to create user accounts:
- Create users and grant privilege through standard user-managed `SQL` statements, such as `CREATE USER` and `GRANT` statements. (Recommended way)
- Modify authorization tables directly with `INSERT`, `UPDATE`, and `DELETE` operations.

For example: 
```
CREATE USER 'test'@'127.0.0.1' IDENTIFIED BY '1234';
```

After setting the login password, the `authentication_string` is encrypted by `TiDB` and stored in the `mysql.user` table.

The user account name for `TiDB` consists of a username and a hostname. The syntax for the account name is `'<user_name>'@'<client_host_name>'`.
- `<user_name>` is case sensitive.
- `<client_host_name>` can be a hostname or an IP address. Wildcard character `%` and `_` are allowed in hostname or IP address. For example, a hostname named `'%'` can match all host, and `'192.168.1.%'` can match all host in a subnet.

If no `<client_host_name>` is specified, the default means anywhere. If no password is specified, the default password is empty:
- `CREATE USER 'test'` is equivalent to `CREATE USER 'test'@'%' IDENTIFED BY ''`;

Please refer to `https://docs.pingcap.com/tidb/stable/user-account-management` for details.